v1.37.1

Official Envoy changelog summary with source attribution, release tags, and community reactions.

Track this Envoy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Envoy·6 months ago · Mar 11, 2026, 01:56 AMFixSecurity-relevantAI-assisted summary

Summary

Multiple security fixes address CVE‑2026‑26330, 26308, 26310, 26309 and 26311 (rate‑limit crash, RBAC header bypass, IPv6 address handling, JSON off‑by‑one write, HTTP decode after reset).
Bug fixes include OAuth2 host‑rewrite handling, ext‑proc chain support and CEL attribute serialization, proper propagation of denied‑authz headers, error‑status handling for ext authz, and a crash on listener removal with access‑log rate...
Introduces an extended ABI forward‑compatibility mechanism for dynamic modules, updates contrib binary version strings, and refreshes dependencies such as googleurl, Kafka test binary and Docker base images.

securitybugfixfeaturesource healthy

Official source Last checked 14 hours ago

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 14 hours ago

related channels

Turn this Envoy release note into a weekly digest for the tools you actually use.